Playwright MCP still triggers ARC approval prompts in danger-full-access / approval_policy=never, including localhost workflows

Open 💬 2 comments Opened Mar 25, 2026 by LeapilityBot

What version of Codex are you using?

Codex Desktop on macOS. I do not have the exact build number handy, but this is still reproducible on March 25, 2026.

What subscription do you have?

ChatGPT subscription account.

What platform is your computer?

macOS on Apple Silicon.

What issue are you seeing?

Playwright MCP still gets interrupted by approval prompts and ARC safety checks even when Codex is configured for full access:

approval_policy = "never"
sandbox_mode = "danger-full-access"
approval_mode = "auto"

This is not limited to obviously risky actions. It also affects normal local automation workflows, including navigation to localhost / loopback URLs such as http://127.0.0.1:3001.

In addition, browser_evaluate calls that inspect browser state can trigger ARC approval cards such as:

Tool call needs your approval. Reason: Potential sensitive localStorage access; ambiguous intent and encrypted reasoning present.

This effectively breaks browser automation in Codex Desktop. In practice, it also breaks any higher-level automation or recurring workflow that depends on Playwright MCP, because the run stalls waiting for manual approval.

Why this is severe

This is not just an inconvenience.

It breaks end-to-end browser automation, local app testing, and any automation plans that rely on Playwright MCP. If an automation cannot navigate to a local dev server or inspect browser state without a human clicking approval cards, the automation is no longer actually automatable.

For my usage, this regresses Codex from an autonomous browser operator into a tool that frequently blocks on manual confirmation.

What steps can reproduce the bug?

Configure Codex with:

approval_policy = "never"
sandbox_mode = "danger-full-access"
approval_mode = "auto"

Enable Playwright MCP.
Start a local dev server, for example on 127.0.0.1:3001.
Ask Codex to use Playwright to navigate to the local app and continue a multi-step workflow.
Observe that approval prompts can still appear instead of the workflow proceeding autonomously.
Ask Codex to inspect browser state with Playwright, for example via browser_evaluate that reads from window.localStorage.
Observe ARC-driven approval prompts such as:

Potential sensitive localStorage access; ambiguous intent and encrypted reasoning present.

What is the expected behavior?

If Codex is configured with approval_policy = "never" and sandbox_mode = "danger-full-access", Playwright MCP workflows should not be interrupted by approval prompts for routine local automation tasks.

At minimum:

localhost / loopback navigation such as 127.0.0.1 should not be treated the same way as arbitrary open-world browsing
session-level approval should not be required repeatedly for normal Playwright actions
ARC should not block or interrupt the workflow for normal local development automation in a full-access configuration

Additional information

Related but not identical reports:

#15169 discusses Playwright MCP approvals repeatedly interrupting workflows in Codex App for macOS
#15437 discusses raw MCP tools not being auto-approved in Codex Desktop